DHCP Relay, VLANs, Gateways

Once you direct DHCP requests from the VLANs to the Admin/DHCP Server subnet, then you'll just need to create and activate the scopes in the DHCP Server, and disable/delete the scope from the XG. 

Thanks. I'm doing something wrong in Sophos then because I have to have the Scope to be able to set a relay, and then XG doesn't let me leave the range empty.

Windows DHCP Servers: 10.0.0.x / 10.0.0.y
Sophos XH LAN IP (GW): 10.0.0.1

There's no need to setup a DHCP Server or Scope in the XG; all DHCP functions will be done on the server.  As long as the 10.0.0.x and 172.x.x.x subnets are all accessible from the XG, then you just tell it to forward those broadcast packets from 172.x.x.x to the DHCP server on 10.0.0.x.   Edit: I'm assuming you have all VLANs defined as sub-interfaces on your primary LAN port...

In example, I have one DHCP Server (10.4.5.25), and one of these for each VLAN:

Hope that helps.. 

Thanks again. I see, so the Relay config. is actually for devices on relevant interface. I thought the Relay was just what IPs DHCP existed on, and then the 'use relay' on the DHCP Scope in Sophos just forwarded it on to the IPs in the Relay.

So it needs to be like this - with a Relay config. for each VLAN. Will I need to add FW rules for DHCP to travel between zones? My 2 WiFi VLANs are on the WiFi zone and VoIP is on the LAN zone

PS: Told you I was doing it wrong

That looks good to me; it's saying "any DHCP broadcast packets received from the interface 172.14.0.1 should get directed to 10.0.0.240/.241".  No extra firewall rules are needed.  Off the top of my head tho, depending on your wifi controller, you may need to confirm there isn't anything blocking DHCP relay from the APs, but since you had the Sophos serving IPs before, likely should be fine as-is.

Brilliant. Thanks for your help

Oh actually, on the Windows DHCP side do I specify 10.0.0.1 for 003 Router value, or still 172.14.0.1 from the VLAN IP?

In the scope options, router/gateway will still be the 172.14.0.1; that's the local entrance/exit for the subnet traffic.  Keep in mind, depending on your internal DNS, NTP, SMTP, etc requirements, if they're in diff subnets, you'll need to create firewall rules to allow that traffic (DHCP Relay is special tho).  But I could be getting ahead.  Let's get the relay working first. lol

In the scope options, router/gateway will still be the 172.14.0.1; that's the local entrance/exit for the subnet traffic.  Keep in mind, depending on your internal DNS, NTP, SMTP, etc requirements, if they're in diff subnets, you'll need to create firewall rules to allow that traffic (DHCP Relay is special tho).  But I could be getting ahead.  Let's get the relay working first. lol

Yes I already have Zone rules for DNS and NTP.

Thanks again for your help. I'll see how I get on.